Security at Estimatic
We take the security of your data seriously. Your customer information, business data, and uploaded photos are protected by multiple layers of security controls.
Encryption Everywhere
- check_circleTLS 1.3 for all data in transit
- check_circleAES-256 encryption for data at rest
- check_circleSecure key management via cloud KMS
Database Security
- check_circleRow-Level Security (RLS) policies
- check_circleEach shop can only access their own data
- check_circleService role keys never exposed to clients
Application Security
- check_circleCloudflare Turnstile spam protection
- check_circleCSRF and XSS prevention
- check_circleInput validation on all API endpoints
Monitoring & Alerting
- check_circleSentry error tracking and alerting
- check_circleReal-time application performance monitoring
- check_circleAnomaly detection on API usage patterns
Authentication
- check_circleSupabase Auth with secure session management
- check_circleGoogle OAuth 2.0 social login
- check_circleMagic link email authentication
Infrastructure
- check_circleHosted on Vercel edge network (SOC 2)
- check_circleSupabase managed Postgres (SOC 2 Type II)
- check_circleStripe PCI DSS Level 1 for payments
AI & Photo Data Handling
How we handle uploaded photos:
- Photos are transmitted over encrypted HTTPS connections to our servers
- AI analysis is performed via secure API calls to OpenAI or Google AI
- Photos are not used to train third-party AI models
- Photos are stored in your Supabase project storage with RLS protection
- You can delete photos and lead data at any time from your dashboard
Compliance
SOC 2
Infrastructure providers are SOC 2 certified
PCI DSS
Payment processing via Stripe Level 1
Responsible Disclosure
If you discover a security vulnerability, we appreciate your help in disclosing it responsibly. Please report vulnerabilities to security@estimaticai.com. We aim to acknowledge reports within 48 hours and will work with you to resolve issues promptly.
Please do not publicly disclose vulnerabilities until we have had a chance to address them. We appreciate your cooperation in keeping Estimatic secure for all users.
Questions About Security?
Our team is happy to answer security questions or provide additional documentation for your compliance requirements.
Contact Us